WP Manifestindependent plugin directory
manifest / integrations / pressforge

PressForge

WooCommerce HMAC webhook bridge WordPress plugin (Full-Stack Escalation 2.0)

by Malcolm Cuady · github.com/jcuady/pressforge · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/jcuady/pressforge/archive/refs/heads/main.zip

Readme

PressForge

WordPress plugin that bridges WooCommerce orders to an external ops webhook (Make.com or any custom HTTPS URL) with HMAC-SHA256 signed JSON payloads, an admin settings page, and a public REST health endpoint.

Portfolio project (2026). Built to demonstrate WordPress / WooCommerce / custom PHP agency work: Settings API, order hooks, signed outbound HTTP, and wp-json routes. Not a commercial product and not affiliated with Make.com or WooCommerce.

Requirements

  • WordPress 6.4+
  • PHP 8.2+
  • WooCommerce (required; plugin shows an admin notice if inactive)

Install as a WordPress plugin

  1. Copy this folder into wp-content/plugins/pressforge/ (or zip the folder and upload via Plugins > Add New > Upload).
  2. Activate PressForge under Plugins.
  3. Ensure WooCommerce is installed and active.
  4. Open WooCommerce > PressForge.
  5. Set Webhook URL (e.g. a Make.com custom webhook) and a Signing secret.
  6. Save. Complete a test order or mark an order completed to fire the webhook.

No WooCommerce API keys or store credentials are stored. Only the webhook URL and shared signing secret you enter.

Architecture

pressforge.php
  -> PressForge_Plugin          # bootstrap, admin menu, WooCommerce guard
       -> PressForge_Settings   # Options API (URL, secret, enable, timeout)
       -> PressForge_Woo_Hooks  # order.completed / checkout / thankyou
       -> PressForge_Webhook_Client  # HMAC-SHA256 POST via wp_remote_post
       -> PressForge_REST       # GET /wp-json/pressforge/v1/health

Events

Hook Event name
woocommerce_order_status_completed order.completed
woocommerce_checkout_order_processed checkout.processed
woocommerce_thankyou checkout.thankyou

Same-request duplicate order IDs are skipped once.

Signature

  • Header X-PressForge-Signature: hex(HMAC-SHA256("{timestamp}.{raw_json_body}", secret))
  • Header X-PressForge-Timestamp: Unix seconds
  • Header X-PressForge-Event: event name

Receivers should recompute the HMAC and compare with hash_equals.

Health

GET /wp-json/pressforge/v1/health

Returns version, WooCommerce presence, enabled flag, and whether URL/secret are set. Does not expose secrets.

Local Docker (optional)

cp .env.example .env
docker compose up -d

Then install WooCommerce from the WordPress admin (or WP-CLI). Mount this repo into wp-content/plugins/pressforge. See docker-compose.yml.

Tests

php tests/WebhookClientTest.php

Asserts HMAC sign/verify without a full WordPress bootstrap.

Honesty (portfolio 2026)

  • Demo / portfolio code for agency-style WordPress + WooCommerce PHP delivery.
  • Uses WordPress APIs (register_setting, WooCommerce actions, wp_remote_post, REST).
  • Does not include real store keys, live Make.com scenarios, or production support SLAs.
  • Extend with retries, dead-letter logging, or per-event toggles as needed for a client.

License

GPL-2.0-or-later (WordPress plugin convention).

Read the full README on GitHub →